Medium ELSA-2021-4059 2 CVEs

Moderate: curl security update (Oracle Linux 8)

Published Nov 2, 2021 · Updated Nov 2, 2021

Ecosystem: Oracle Linux

Summary

[7.61.1-18.el8_4.2]
- fix STARTTLS protocol injection via MITM (CVE-2021-22947)
- fix protocol downgrade required TLS bypass (CVE-2021-22946)

Fixed packages 4

Release	Package	Fixed in
Oracle Linux · 8	curl	0:7.61.1-18.el8_4.2
Oracle Linux · 8	libcurl	0:7.61.1-18.el8_4.2
Oracle Linux · 8	libcurl-devel	0:7.61.1-18.el8_4.2
Oracle Linux · 8	libcurl-minimal	0:7.61.1-18.el8_4.2

Vulnerabilities 2

High 7.5

CVE-2021-22946

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or F…

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Sep 29, 2021
Medium 5.9

CVE-2021-22947

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS …

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Sep 29, 2021